Security Advisory

SECURITY ADVISORY: Remository SQL Injection Vulnerability

Published:  October 7, 2025

Severity: Critical (CVSS 9.8)

Affected Versions: All Remository versions prior to 4.2.20has been

Fixed In: Version 4.5.0

CVE: Pending assignment

Summary

A critical SQL injection vulnerability was discovered on 7 October 2025 in Remository's classify view that could allow unauthenticated attackers to execute arbitrary SQL queries against your database.

Impact - SQL Injection in the classify view parameter - Potential unauthorized database access - Possible data extraction or modification - Affects all Remository installations prior to this patch

Affected Code

The vulnerability exists in:

  • components/com_remository/src/Controllers/Advsearch.php (classify view handling)
  • components/com_remository/src/Managers/ClassificationManager.php (database query)

Solution

Immediate action - upgrade to version 4.5.0. Available at https://remository.com/downloads/01_-Remository/Remository-4_5_0/

Or apply manual patch - from https://remository.com/downloads/07_-Public-Files/Patch-for-Remository-4_2_19-or-earlier/

Details
Hits: 720

Explore Repository

open all | close all

Fighting Spam

We run our own mail server, but we have front ended it with a spam blocker by MX Guard Dog. This enables us to run our mail server with much lower resources, because it does not need anti-spam or anti-virus software. If you want help to do the same, get in touch.

We use cookies

We use cookies on our website. Some of them are essential for the operation of the site, while others help us to improve this site and the user experience (tracking cookies). You can decide for yourself whether you want to allow cookies or not. Please note that if you reject them, you may not be able to use all the functionalities of the site.

Ok Decline